| name | auth-session |
| description | Use when issuing authenticated session cookies: issue HTTP only, secure, same site session cookies for authenticated requests. |
| slipstream | {"category":"auth","requires":["backend-hono-api"],"verification":{"kind":"test","description":"Session tests pass.","command":"pnpm --dir {{apiDir}} test"},"tags":["auth","security","launch"]} |
Overview
Issue HTTP only, secure, same site session cookies for authenticated requests.
Steps
- Set the session cookie with
HttpOnly, Secure, SameSite=Lax and a sensible Max-Age.
- Sign or encrypt the cookie payload so it cannot be tampered with.
- Rotate the session on privilege change.
Verify
Run the tests and confirm the issued cookie carries the HttpOnly and Secure flags.